Legal Counsel

1. What is an NDA, and when should it be signed?
Before exchanging any non-public information.

2. What kinds of data require protection?
PII, client financials, strategy docs, and health-related data.

3. How do I store and share client documents securely?
Encrypted cloud, role-based access, avoid personal devices.

4. IP ownership vs. licensing?
Ownership = full control; licensing = limited, defined use.

5. Disclaimers for internal research?
Mark exploratory; requires validation; not binding advice.

6. Can I use public datasets?
Yes, if permitted and cited; avoid proprietary sets without rights.

7. Handling confidential emails/notes?
Label “Confidential”; restrict recipients; follow policy.

8. Consequences of mishandling data?
Contract breach, fines, reputational harm, access removal.

9. When to escalate?
Suspected breach, unclear rights, conflicting contract terms.

10. Early-stage risks?
Vague scope, unclear deliverable ownership, non-standard terms.

1. What must a services agreement include?
Scope, deliverables, timeline, payment, IP, confidentiality, termination, disputes.

2. Who owns deliverables?
As stated in the contract; don’t assume.

3. Missed deadlines implications?
Possible breach; manage via change control and notices.

4. Indemnity clauses?
Allocate responsibility for losses caused by a party’s actions.

5. Proposal language to avoid?
Guarantees, legal conclusions, unsupported claims.

6. Anti-bribery/anti-corruption?
Follow policy; document gifts/expenses; no undue influence.

7. Personal liability?
Depends on entity, contract, insurance (E&O recommended).

8. Conflicts of interest?
Disclose early; seek guidance; recuse if needed.

9. Reusing prior materials?
Only with rights; respect confidentiality and IP terms.

10. Insurance to consider?
Professional liability, cyber, general liability.

1. Ensure terms are followed?
Track milestones, approvals, compliance artifacts.

2. Frameworks to review?
GDPR, HIPAA, ISO 27001, SOC 2, SOX (as relevant).

3. When to involve legal?
Non-standard terms, unclear risk, cross-border rules.

4. Ethical client requests?
Document and escalate; avoid informal resolutions.

5. Role in audits?
Liaise, ensure complete documentation, record decisions.

6. Third-party risk?
Due diligence, DPAs, data handling reviews.

7. Approving exceptions?
Only with delegated authority and documented rationale.

8. Coaching juniors?
Checklists, reviews, short refreshers, exemplars.

9. Exposure signals?
Gaps in records, vendor noncompliance, repeated flags.

10. Managing escalations?
Use governance paths; write everything down.

1. Portfolio-level responsibility?
Governance maturity, risk posture, embedded controls.

2. Designing governance?
Clear roles, escalation, documentation, ownership.

3. Enterprise transformation signals?
Regulatory shifts, IP transfer risk, compliance gaps.

4. Limiting liability?
Liability caps, indirect damage exclusions, outcome disclaimers.

5. Partner alignment audits?
Contract/ policy review; joint IP & compliance checks.

6. Global compliance trends?
AI regulation, data privacy, ESG disclosures.

7. Integrating ESG/DEI?
Clauses in SOWs; define metrics and reporting.

8. M&A/restructuring support?
Legal due diligence; change-of-control mapping.

9. Platform model risks?
IP misuse, data exposure, worker classification.

10. Working with boards/GCs?
Clear risk narratives; actionable mitigations.

• Non-standard or client-authored contracts.
• Unclear IP ownership or licensing terms.
• Regulatory exposure (e.g., privacy, healthcare, finance).
• Disputes, complaints, or threat of litigation.
• Cross-border work or unfamiliar jurisdictions.
• Negotiating indemnity, liability caps, or remedies.
• High-value transactions, equity, or JV agreements.

Questions for a consultation:

• Experience with this issue/industry and with consulting firms.
• Billing approach (hourly, fixed-fee, project-based).
• Who does the work; typical turnaround time; communication style.
• Security, confidentiality, references, similar matters handled.
• Key risks to consider and initial strategy.

Best practices:

• Speak with 2–3 firms; choose on fit and clarity, not price alone.
• Get a written engagement letter; track advice and decisions.

• Archive signed contracts/NDAs; ensure easy retrieval.
• Maintain versioned deliverables with timestamps.
• Document scope changes, approvals, and key comms.
• Track licenses/permissions for third-party content.
• Keep compliance logs for regulated work.
• Review insurance (E&O, cyber, general liability).
• Use access controls and audit trails on shared drives.
• Follow data retention/deletion timelines.
• Summarize delivery model and risk posture.
• Pre-brief legal on historical red flags.

• Define IP and usage rights in the agreement.
• Deliver via secure, permissioned platforms.
• Watermark sensitive PDFs or add version stamps.
• Separate “final” vs. “editable” files.
• Keep a private archive of drafts and research.
• Get written acknowledgment of receipt.
• Restrict reuse/transfer without consent.
• Use disclaimers where models are preliminary.
• Track access/downloads when possible.
• Maintain online and offline backups.

Key topics when working internationally:

• Governing law and jurisdiction selection.
• Data transfer and privacy agreements (e.g., SCCs, DPAs).
• Tax and employment-classification exposure.
• Cross-border IP protection and enforcement.
• Enforceability of judgments and arbitration awards.

• Amendments: Reference original agreement; date changes; capture signatures.
• Notices: Follow the notice clause; use traceable channels.
• Disputes: Stage mediation → arbitration → litigation as appropriate.
• Documentation: Summarize calls and decisions in writing.
• Escalation: Use your governance path; avoid informal fixes for high-risk issues.

• NDAs protect non-public information; they don’t cover public or independently created materials.
• Use encrypted platforms and role-based access; label sensitivity levels.
• Understand GDPR/CCPA obligations if handling personal data across regions.
• Use DPAs with vendors; define retention and deletion schedules.
• Apply disclaimers where deliverables are preliminary or advisory.

• Healthcare: HIPAA/PHI handling; access controls; BAAs as needed.
• Financial Services: AML/KYC, SEC/FinCEN guidance; record-keeping.
• Education: FERPA for student records; least-privilege access.
• E-commerce: PCI DSS, consumer protection, clear refund/return terms.
• Public Sector: FOIA and procurement rules; records may be public.
• Energy/Environment: Permits, ESG disclosures, emissions reporting.
• Real Estate: Fair Housing compliance; avoid discriminatory filters.
• Transport/Mobility: DOT/NHTSA safety, fleet compliance.
• Technology & SaaS: GDPR/CCPA, DPAs, export controls.

Tip: Ask clients about mandated frameworks early and plan reviews with counsel where stakes are high.